On Sun, Sep 05, 2004 at 01:53:21PM +0200, Tom Kistner writes:
TK> Pavel Gulchouck wrote:
TK>
TK> >I've try to setup clamd malware to remote host, and see that it does not
TK> >work. As I can see in the sources, STREAM command for clamd does not
TK> >implemented, so, exim+exiscan can use only local clamd which has read
TK> >access to files in the exim spool directory.
TK>
TK> Remote AV scanning does not scale. The additional IO overhead eats up
TK> the gain in CPU cycles. And since scanning at the DATA phase must the
TK> synchronous, you don't even save resources on your SMTP machine.
TK>
TK> AV scanning should be done on the box where mail is delivered into. If
TK> you need to scale, you need multiple SMTP input machines, each with its
TK> own AV.
In my case CPU performance and LAN traffic is not critical, but single
clamd is more simple for supporting and monitoring, updates will be
received only once, it may be run under different OS etc.
So, clamav has possibility for using remote server, exiscan syntax
has possibility for specifying IP of remote clamd, but this feature
is not implemented. :( It is implemented for drwebd.
It's not very needed, but it will be a bit comfortable for me if
this feature will be implemented. ;-)
TK> >And another feature request: I want to check mail by two different
TK> >antiviruses (drwebd and clamd), but I cannot do this now with malware. :(
TK>
TK> You can. From the docs:
TK>
TK> -----------------------------------------------------------------
TK> ADVANCED TIP: When the av_scanner option starts with a dollar
TK> ($) sign, it is expanded before being used. This is useful if
TK> you want to use multiple scanners. You can then set
Thanks!
I've looked at the old version of exiscan (4.41-24), sorry.
--
Lucky carrier,
Pavel.
